SMSGELY – Order SMS Notification & Login OTP For WooCommerce

Description

SMSGELY for WooCommerce connects your store to SMSGELY, a business SMS service and Bangladesh SMS gateway. It sends WooCommerce SMS notifications when an order changes status, and lets customers log in, register and verify their phone number with a one-time password (OTP) sent by SMS.

• WooCommerce order SMS notifications — your customers (and, if you like, your team) get an SMS when an order is placed, processing, on hold, completed, cancelled, failed or refunded.
• OTP login and registration — customers sign in or create an account with their mobile number and a one-time code, on the My Account page or at checkout.
• Phone verification — a new mobile number is saved only after the customer confirms it with a code.

Every message is sent through the SMSGELY SMS API using your own SMSGELY account. Everything is set up from one SMSGELY menu in your WordPress admin. No coding, shortcodes or theme changes are needed.

The plugin is designed for Bangladeshi mobile numbers and supports English and Bangla SMS. 01712345678, +8801712345678 and 8801712345678 are all understood as the same number.

This plugin is the SMSGELY integration for WooCommerce, published by the team behind SMSGELY. It needs an SMSGELY account to send messages. It is not part of WordPress or WooCommerce, and it is not affiliated with or endorsed by WordPress.org, WooCommerce or Automattic.

The plugin adds no credit, link or logo to your store. An optional “Powered by SMSGELY” line under the OTP login form appears only if you turn it on in SMSGELY → Settings.

Features

• WooCommerce order SMS for seven order events, each with its own on/off switch
• Send to the customer, up to five admin numbers, or both
• OTP login and OTP registration on My Account, the classic checkout and the WooCommerce Checkout Block
• Phone number verification in My Account → Account details
• English and Bangla SMS templates with placeholders and a live preview
• Character count and SMS part estimate while you type
• Background sending with WooCommerce’s Action Scheduler
• Duplicate-send protection and safe automatic retries
• SMS logs with filters, one-click retry and delivery status
• Rate limits per phone number and IP address
• Optional CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA or a built-in math question, plus a honeypot field
• Daily and monthly SMS limits to protect your SMSGELY wallet
• Encrypted storage of the API key and CAPTCHA secret keys
• Compatible with WooCommerce High-Performance Order Storage (HPOS)
• Works with WordPress personal data export and erase
• Translation-ready

How it works

WooCommerce SMS notifications

1. You connect your SMSGELY account in SMSGELY → Connection with an API key from your SMSGELY dashboard.
2. You choose which order events send an SMS, and to whom.
3. When an order reaches one of those statuses, the plugin queues the message in the background.
4. The plugin sends the message to the SMSGELY SMS API over HTTPS.
5. SMSGELY delivers the SMS and bills your SMSGELY wallet.

OTP login, registration and phone verification

1. The customer enters their mobile number on the login, registration or checkout form.
2. The plugin asks SMSGELY to send a one-time code to that number.
3. The customer types the code into the form.
4. Your server checks the code. The customer is logged in, or continues to a short registration form if the number is new.

The plugin does not include an SMS gateway or SMS credit of its own. SMSGELY is the external service that sends every message.

Choose the features you need

In SMSGELY → Settings → Choose Your SMSGELY Features, pick one of:

• Login & Registration OTP — phone login, registration and phone verification only.
• WooCommerce Order SMS — order status SMS only. Your store keeps the normal WooCommerce login.
• Both — everything (the default).

A feature you switch off is not loaded at all: it adds nothing to your store pages and sends no SMS. Switching never deletes settings, templates or logs, so you can switch back at any time.

WooCommerce order SMS notifications

• Turn each order event on or off.
• Choose who receives each message: the customer, up to five admin numbers, or both.
• Messages are sent in the background with WooCommerce’s Action Scheduler, so checkout is not slowed down.
• A failed SMS never changes or blocks the order. The result is added as a private order note with the number masked (you can turn this off).
• Works for registered customers and guest orders; the billing phone number is used.

Supported order events:

• New order (when the customer places the order)
• Processing
• On hold
• Completed
• Cancelled
• Failed
• Refunded

“New order” and “Completed” are on by default. “Processing” is off by default, because most paid orders trigger both “New order” and “Processing”.

OTP login and registration for WooCommerce

• Works inside the WooCommerce My Account page, the classic checkout and the WooCommerce Checkout Block. Logging in at checkout keeps the cart.
• Choose the login screen: OTP with a “Continue with password” option (default), the normal WooCommerce form with an OTP option, or OTP only.
• Codes have 6 digits and expire after 5 minutes by default; you can change both.
• Existing customers are found by their verified number or their WooCommerce billing phone, so nobody gets a second account. Tools → Link existing customers prepares all existing accounts at once.
• New numbers continue to a short registration form. You decide whether email and password are required, optional or hidden.
• Existing passwords are never removed, and administrators and shop managers always log in with their password.

Phone number verification

Customers can add or change their mobile number in My Account → Account details. A new number is saved only after it is confirmed with a code, and the verified number is also used as the WooCommerce billing phone.

English and Bangla SMS templates

Every message has an English and a Bangla template. Choose the SMS language once; edit the text with a live preview and insert placeholders with a click:

• Order SMS: {customer_name}, {first_name}, {order_id}, {order_total}, {order_status}, {order_date}, {payment_method}, {item_count}, {billing_city}, {phone}, {site_name}
• OTP: {otp}, {expiry_minutes}, {site_name}

SMS length and segments

Long messages are sent as several SMS parts, and each part is billed. While you type, the editor shows the character count and the estimated number of parts: plain English text (GSM-7) fits 160 characters in one SMS, and Bangla (Unicode) fits 70. SMSGELY’s own count is the one that is billed.

Sender ID

Choose the SMS type — non-masking (default, recommended for OTP) or masking (your brand name). SMSGELY sends from your account’s Primary Sender ID for that type. Sender IDs are managed in your SMSGELY account and cannot be typed into the plugin.

SMS logs and delivery tracking

• Every message is listed in SMSGELY → SMS Logs with filters for date, type, status, order, phone number and Sender ID. Phone numbers are masked, and OTP text is never stored.
• When your API key has the sms:read permission, the plugin checks SMSGELY a few times after sending and shows when a message is delivered.
• Failed order messages can be retried with one click.

Duplicate-send protection

Each order event is sent only once per order and recipient, even if WooCommerce saves the same status several times. Temporary errors are retried automatically (up to three attempts) with the same request key, so SMSGELY does not send or charge twice.

Security and bot protection

• One-time codes are generated with a cryptographically secure random number generator, expire after a few minutes, work only once and are limited in attempts and resends. Only a keyed hash is stored, never the code itself.
• Rate limits per phone number and IP address, with temporary blocking of abusive traffic.
• Optional CAPTCHA: Cloudflare Turnstile, Google reCAPTCHA (v3 or v2) or a built-in math question, plus a hidden honeypot field. “Adaptive” mode only challenges suspicious requests. Every CAPTCHA token is checked on your server.
• Login responses do not reveal whether an account exists for a number.
• Optional daily and monthly SMS limits, a daily OTP limit and a monthly spending limit help protect your SMSGELY wallet.
• The API key and CAPTCHA secret keys are stored encrypted, are never sent to the browser, and can be defined in wp-config.php instead.
• Admin actions check the user’s permissions and a WordPress nonce; OTP requests are checked with a nonce. Database queries use prepared statements, input is sanitized and output is escaped.
• The SMSGELY API address must use HTTPS and be on smsgely.com.

These features are meant to help you run a safer store. They do not guarantee security or legal compliance.

Built for current WooCommerce

• Compatible with High-Performance Order Storage (HPOS), on or off.
• Works with the classic checkout and the WooCommerce Checkout Block.
• Pages that do not show a login form — home, shop, product and cart — load no plugin scripts, styles or CAPTCHA.
• Translation-ready (text domain smsgely-order-sms-otp).

Your SMSGELY account and the SMS API

You need your own SMSGELY account. You create an API key in your SMSGELY dashboard and paste it, with the API address shown there, into SMSGELY → Connection. The plugin then sends each message to the SMSGELY SMS API over HTTPS, and SMSGELY delivers it and bills your SMSGELY wallet at your account’s rates. The plugin itself is free and does not include SMS credit. See “External services” below for exactly what is sent.

Requirements

• WordPress 6.5 or later and PHP 7.4 or later.
• WooCommerce (the plugin stays inactive without it).
• An SMSGELY account with approved identity verification (KYC), wallet balance and an API key with the sms:send permission (add sms:read for delivery reports).
• A server that can make outgoing HTTPS requests.

Support

• For help with the plugin, use the support forum here on WordPress.org.
• For your SMSGELY account, Sender IDs, balance or API keys, contact SMSGELY support.
• SMSGELY’s SMS API guide explains API keys and permissions.

Troubleshooting

• “Invalid API key” — copy the key again from SMSGELY and make sure it is still active.
• “Forbidden” or “insufficient scope” — the key needs the sms:send permission, and if you restricted the key to certain IP addresses, your server’s IP must be one of them.
• “Insufficient balance” — recharge your SMSGELY wallet, then retry failed messages from SMS Logs.
• “Masking not approved” — switch the SMS type to non-masking until your masking Sender ID is approved.
• Messages stay “Pending” — WordPress’s scheduled tasks may not be running. Check WooCommerce → Status → Scheduled Actions.
• Customers see “Too many requests” — review Security → Rate limits, or use Tools → Reset rate limits.
• The OTP form does not appear — check that Login & Registration OTP is chosen in Settings, that SMSGELY is connected, and that login or registration is turned on in OTP Login.

External services

The plugin connects to the services below only after you set them up. It does not collect analytics or telemetry and does not contact any other service.

SMSGELY (required)

SMSGELY delivers the SMS messages.

• When: when an enabled order event happens, when a customer requests an OTP, when you save the Connection settings or click “Check connection” or “Send real SMS”, and a few times after sending to check delivery status (only if your API key has the sms:read permission). Nothing is sent before you enter an API key, and nothing is sent while a page is being displayed.
• What is sent: your API key (for authentication), the recipient’s phone number, the message text, the SMS type and a message reference number. Order messages contain what your templates include, such as order number, customer name, total and status; OTP messages contain the one-time code.
• Where: the SMSGELY API address you enter, which must be on smsgely.com.
• SMSGELY Terms and SMSGELY Privacy Policy.

Cloudflare Turnstile (optional)

Used only if you choose Turnstile as the CAPTCHA. Its script loads only on the OTP login and registration forms (in Adaptive mode, only when a check is needed). Cloudflare receives technical information from the visitor’s browser, and your server sends the check token and the visitor’s IP address to Cloudflare to verify it.

• Cloudflare Turnstile Privacy Addendum and Cloudflare Website Terms.

Google reCAPTCHA (optional)

Used only if you choose reCAPTCHA as the CAPTCHA, under the same conditions as Turnstile. Google receives technical information from the visitor’s browser, and your server sends the check token and the visitor’s IP address to Google to verify it.

• Google Privacy Policy and Google Terms of Service.

Links in the admin screens

The SMSGELY admin pages contain links to your SMSGELY dashboard, API guide and support (smsgely.com). They open only when you click them; no data is sent to SMSGELY by showing them.

Privacy

The plugin adds no analytics, advertising or tracking code. It contacts SMSGELY only to send messages and check their delivery, and Cloudflare or Google only if you enable their CAPTCHA (see “External services”).

The plugin stores, in your WordPress database:

• SMS log — reference, date, type, order number, recipient phone number (shown masked), status, part count and cost if SMSGELY reports it. The text of order messages is kept so you can review and retry them; OTP text is never stored. Entries are deleted after 90 days by default (you can change this).
• OTP checks — the phone number, keyed hashes of the code and of the visitor’s IP address, attempt counts and times. Deleted within a day.
• Rate-limit counters — keyed hashes only, deleted when they expire.
• Verified number — linked to the WordPress user and also saved as the WooCommerce billing phone.

When a visitor requests a code, the plugin sets one functional cookie, smsgely_woo_otp (HttpOnly, expires within an hour), that links the browser to the pending verification. It is not used for tracking.

The plugin works with WordPress’s personal data export and erase tools and suggests text for your privacy policy. Erasing removes or anonymizes only this plugin’s data — never WordPress users or WooCommerce orders. Deactivating the plugin keeps all data; deleting it removes the plugin’s data only if you turn on “Delete plugin data when uninstalling” in Settings.

As the site owner, you are responsible for your SMSGELY account and for telling your customers how their phone numbers are used, as your local privacy laws require.

define( 'SMSGELY_API_KEY', 'your-key' );